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Q . Abstract 

We give a new characterization of NL as the class of languages whose members have cer- 
CNJ I tificates that can be verified with small error in polynomial time by finite state machines that 

^ ' use a constant number of random bits, as opposed to its conventional description in terms of 

deterministic logarithmic-space verifiers. It turns out that allowing two-way interaction with 
■ the prover does not change the class of verifiable languages, and that no polynomially bounded 

I amount of randomness is useful for constant-memory computers when used as language rec- 



ognizers, or public-coin verifiers. A corollary of our main result is that the class of outcome 
^-^ I problems corresponding to 0(log n)-space bounded games of incomplete information where the 

universal player is allowed a constant number of moves equals NL. 
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1 Introduction 

It is known that allowing constant-memory computers to use random bits and to commit small 
amounts of error increases their power, both as language recognizers |Fre81j . and as verifiers of 
membership proofs |CL891 [DS92j . In this paper, we examine the effects of restricting such proba- 
bilistic machines (2pfa's) to use only a constant number of random bits, independent of the length 
of the input. We prove that such constant-randomness 2pfa's are able to verify membership in 
precisely the languages in NL. This is an interesting addition to the facts that NL has deterministic 
logspace verifiers, and NP is the class of languages that has logspace verifiers that use logarith- 
mically many random bits |CL95j . We obtain this result by demonstrating that such verifiers are 
equivalent to multihead finite automata. Allowing these constant-coin verifiers to use logarithmic 
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space, and to have two-way interaction with the prover, does not augment the class of verifiable lan- 
guages. No nonregular language has such an interactive proof system if the verifier is restricted to 
use public coins. We also show that, when used as recognizers, no amount of polynomially-bounded 
randomness gives standard 2pfa's any power beyond their deterministic versions. 

The rest of this paper is structured as follows: Section [2] provides the necessary background. 
Our results on the new characterization of NL in terms of finite state verifiers, and the public-coin 
case, are presented in Section [3l Several variants of the verifier model are examined in Sections 
m and O A characterization of the class of outcome problems corresponding to 0(log n)-space 
bounded games of incomplete information where the universal player is allowed a constant number 
of moves is given in Section [6l Section [7| is a conclusion. 

2 Preliminaries 

For background on interactive proof systems with bounds on the usage of space and/or randomness, 
the reader is referred to |Con93b| . 

The main model of verifier that we will use is a probabilistic Turing machine (PTM) with a 
read-only input tape and a single read/write work tape. The input tape holds the input string 
between two occurrences of the end-marker symbol and we assume that the machine's transition 
function never attempts to move the input head beyond the end-markers. The input tape head is on 
the left end-marker at the start of the process. The verifier exchanges information with a prover by 
writing and reading one symbol at a time from the communication alphabet F in a communication 
cell. Using this information channel, the prover attempts to prove the membership of the input 
string in the language under consideration. Of course, one should not trust this blindly, and we 
even allow the possibility that the prover sends an infinite sequence of symbols, a contingency that 
could cause careless verifiers to run forever. The machine also has access to a source of random bits. 
The state set of the verifier PTM is Q = RLiDL){qa,qr}, where R is the set of coin-tossing states, D 
is the set of deterministic states, and qa (accept) and qr (reject) are the halting states. One of the 
non-halting states is designated as the start state. A configuration of the verifier is defined to be 
the 4-tuple consisting of its current internal state, input head position, work tape content, and work 
tape head position. Associated with each state q £ Q, there is a communication symbol 7^ G F. 
The special "null symbol" e is guaranteed to be a member of F. A "communication step" starts 
when any state q € RU D with 7^ 7^ e is entered, with 7^ being written in the communication cell. 
The prover can be modeled as a prover transition function p, which determines the symbol 7 € F 
to be written in response, based on the input string and the entire communication that has taken 
place so far0 Let <} = {—1, 0, +1} denote the set of possible head movement directions. When the 
verifier reads the response of the prover, it behaves according to the verifier transition function 6 
as follows: For q £ R, 6{q,a,6,'y,b) = (q' ,9' ,di,dw) indicates that the machine will switch to state 
q', write 6' on the work tape, move the input head in direction di G 0, and the work tape head 
in direction d^ € 0, if it is originally in state q, scanning the symbols a, 6, and 7 in the input 
and work tapes, and the communication cell, respectively, and seeing the random bit 6 as a result 
of the coin toss. For q £ D, 6{q,a,0,^) = {q' ,9' ,di,dw) has a similar meaning, but without the 
randomness. If 7^ = e, the verifier transition function described above is applied directly, without 
any communication. 

There are two different definitions of interactive proofs for language membership. We start with 
the "strong" definition. 

^This ensures that the prover is not able to detect how many moves have been executed by the verifier up to the 
present communication step. 
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We say that language L has a (private- coin) interactive proof system (IPS) with error probability 
e if there exists a prover P and a verifier V such that 

1. for every x € L, the interaction of P and V on input w results in acceptance with probability 
at least 1 — e, and, 

2. for every x ^ L, and for any prover P*, the interaction of P* and V on input x results in 
rejection with probability at least 1 — e. 

Interactive proof systems where the verifier accepts every member of the language with proba- 
bility 1 are said to have perfect completeness. 

IP is the class of languages that have interactive proof systems with polynomial-time verifiers, 
and with error probability £ for some e < \. I P( (restriction 1), • • • , (restriction k)) will denote the 
class of languages that have IPSs with (restriction 1), • • • , (restriction k) jCon93b[ ICL95j . We will 
be examining restrictions on expected runtime, worst-case space (i.e. work tape cells), and random 
bits. We use the notations cons, log, poly, and exp to stand for functions that are 0(1), O(logn), 
0{n^), and 2^^"^"^ for any constant c, respectively. For instance, IP = IP (poly-time). 

We will also be considering the effects of restricting tape head movement on our models. In the 
general case, both the input and the work tape heads are allowed to move in both directions (except 
when the input head is on an end-marker) or to stay put, as represented by the set = {—1,0, -1-1} 
in the definition above. A machine where a particular head is not allowed to move left is said to 
have one-way access to the corresponding tape. Heads which are restricted even further so that 
they are not allowed to stay put, and must move right at every step, are called real-time. These 
features will be represented by the notations Iway-input and rt-input, respectively, in the restriction 
lists in class names. 

Replacing condition 2 in the definition above with the weaker condition 

2'. for every x ^ L, and for any prover P* , the interaction of P* and V on input x results in 
acceptance with probability at most e 

leads to our definition of the I P^ (restriction-list) classes, the counterparts of IP (restriction-list) 
with these alternative kinds of verifiers that do not have to halt with high probability for all inputs. 
Note that, since these "weak" IPS's are less constrained than the "strong" ones of the previous 
definition, the IP classes are always contained in the corresponding IP^ classes. 

A one-way interactive proof system |Con93aj is an IPS where the prover is restricted so that it 
maps the set of input strings to the set of sequences from the communication alphabet H For input 
string w, the prover writes the ith symbol of the corresponding sequence in the communication 
cell at the ith time the verifier enters a state q with 7^ 7^ e. This ensures that the communication 
between the prover and the verifier is one-way. The corresponding language classes are named by 
prefixing the class names mentioned above with the designation "oneway-" . Note that a one-way IPS 
can be modeled as a verifier which has one-way access to an additional "certificate" tape, on which 
a purported membership proof of the input string has been written, without the need to mention a 
prover or a communication cell at all, as in the definitions of conventional nondeterministic classes. 

The following equalities are trivial: 



^Note the terminological accident here. We have already used the word "one-way" to describe tape heads which 
can not move to the left. Unfortunately, IPSs where the prover does all the talking also happen to be called with 
this name in the literature. We will be clear about which feature we are referring to throughout the paper. 



NP = oneway- IP (poly-time, poly-space, 0-random-bits) 
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NL = oneway- IP (poly-time, log-space, 0-random-bits) (2) 

Note that specifying as the randomness complexity of the verifier is just a way of saying that 
it is deterministic. 

Allowing logarithmic amounts of randomness yields the characterization |CL95j 

NP = oneway- IP (poly-time, log-space, log-random-bits) , . 

= IP (poly-time, log-space, log-random-bits) 

with an improvement in the space bound. Relaxing the randomness bound of the one-way IPS 
further does not help on its own, since |Con93aj 

oneway- IP (poly-time, log-space) = NP, (4) 

but allowing interaction as well famously yields |Con91l ISha92j 

IP(poly-time, log-space) = PSPACE. (5) 

A public-coin IPS, also known as an Arthur-Merlin game, is an IPS where the coins of the verifier 
can be seen by the prover when they are flipped, thereby ensuring that the prover always knows 
the verifier's configuration during the communication. The public-coin version of IP((restriction 
1), • • • , (restriction k)) will be named AM ((restriction !),••• , (restriction k)), and the notation will 
also be extended to the weak definition in a similar way. It is known |Con891 IGS861 ISha92j that 

AM(exp-time, log-space) = P, (6) 

and 

AM(poly-time, poly-space) = PSPACE. (7) 

The relationships in Equations [T][7] remain true for the weak definition of IPS's, since logarith- 
mically bounded space is sufficient to cut off unacceptably long computational paths. When one 
considers finite state verifiers, |DS92j which use only a constant amount of cells on the work tapeH 
the difference between the weak and strong definitions of becomes evident. 

With no limits on the runtime, or the number of random bits to be used, weak IPS's with finite 
state verifiers exist for a vast class of languages; oneway- 1 P,j„ (cons-space) contains every recursively 
enumerable language, whereas IP (cons-space) is contained in SPACE(2^°'"' ) |CL89j . It has been 
proven |DS92j that Arthur-Merlin games with finite state verifiers exist for languages outside the 
class of languages recognizable by "stand-alone" 2pfa's, and that some languages have linear-time 
finite state verifiers only if the public-coin restriction is not enforced, in contrast to Equations [5] 
andH 

We will focus on verifiers which use a constant number of random bits for any input. 

In the next section, we will demonstrate an interesting relationship between constant-space, 
constant-randomness verifiers and multihead finite automata. A /c-head finite automaton (2nfa(A;)) 
is simply a nondeterministic finite-state machine with k two-way heads that it can direct on a read- 
only tape containing the input string, flanked by two end-markers. A conflguration of a 2nfa(A;) is 
a tuple consisting of its current state and head positions. Deterministic multihead finite automata 
(2dfa(/c)'s) are defined analogously. The classes of languages recognized by these machine families 
will be denoted as 2NFA(fc) and 2DFA(A;), respectively. We will also look at probabilistic versions 
of multihead automata (2pfa(A;)'s). Detailed information about these machines can be found in 
[HKMll] IMac97j . We note the following important facts that will be used in our proofs. 



^It is easy to see that such machines can be simulated by machines with longer programs which have no work tape 
at all, namely, two-way probabilistic finite automata (2pfa's) [Fre81| . 
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Fact 1. Ufc>i2NFA(A;) = NL lHar7S^ . 
Fact 2. Ufc>i2DFA(/c) = L IHarl^ . 

Fact 3. Every 2nfa(k) (resp., 2dfa(k)) has an equivalent 2nfa(2k) (resp., 2dfa(2k)) that halts in 
0{n'^) time on every computational branch. 

Multihead finite automata where all heads are restricted to one-way movement [one-way k-head 
automata) will be denoted lnfa(/i;)'s. The corresponding language classes are named lNFA(/c). The 
probabilistic and deterministic versions of these machines will be denoted lpfa(A;) and ldfa(/c), 
respectively. 

3 2pfa verifiers with constant randomness and 2nfa(A:)'s 

We start our examination of the effects of limiting the number of random bits by noting that 
machines that are not helped by a prover about their input are very weak when restricted to work 
with constant workspace, and polynomially bounded randomness. 

Theorem 1. For any polynomial p, every 2pfa whose expected number of coin tosses on halting 
computational branches is 0{p{n)) for input strings of length n recognizes a regular language with 
bounded error. 

Proof. This is a straightforward modification of the proof (in |DS90j ) of the following fact |DS901 
IKF9T] : 

For any polynomial p, 2pfa's with expected runtime 0{p{n)) recognize only the regular lan- 
guages with bounded error. 

See Appendix El for the details. □ 

Our new characterization of NL is demonstrated by the following lemmas. 
Lemma 1. NL C oneway-IP^ (cons-space, cons-random -bits). 

Proof. Let L be any language in NL. By Fact [H L is recognized by a 2nfa(A;) M. We show 
how to construct a weak one-way IPS with the required properties that recognizes L with perfect 
completeness for any desired error probability e < ^. As mentioned above, this is equivalent to 
demonstrating how every member of L has a membership certificate that can be checked with 
such a verifier. We start by building a verifier V that simulates one run of M, by consulting the 
certificate for choosing among the nondeterministic branches of M. V uses just r = [log k] random 
bits to branch to k computation paths (each path has probability at least 2"'') while scanning the 
left input end-marker. Each such path will use its head to track the position of the corresponding 
head of M. For every step of the simulation of M, the certificate contains a symbol conveying the 
list of k symbols that would be scanned by M's heads at this step, together with an indication of 
which nondeterministic choice should now be taken by M to eventually reach the accept state. The 
ith path of V rejects immediately if it sees that the present certificate symbol is inconsistent with 
what the ith head is currently scanning, and updates its state and head position according to M's 
program and the information given by the certificate otherwise. 

If the input string is accepted by M, the certificate will lead all paths of V to acceptance, 
by giving correct information about what the heads are seeing and the nondeterministic choice at 
every step, yielding a total acceptance probability of 1. Otherwise, any certificate must "lie" about 
at least one head in order to make some paths accept, causing the path responsible for that head 
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to reject, so the acceptance probability in that case is at most 1 — 2"''. To reduce the unacceptably 
high error bound for nonmembers, we chain several copies of V to run one after anotherp on a 
correspondingly long certificate, and accept if and only if all copies accept, rejecting otherwise. 
It is easy to see that a chain of m copies of V involves an error of (1 — 2~^')^, and therefore 
m > 1 — r\ iterations are sufficient to obtain an error of e, where the total number of random 

bits used by the resulting verifier would be 0(A; log log Note that a 2nfa(/c) with state set Q 
has at most \Q\{n + 2)^ distinct reachable configurations on any input of length n, and therefore 
V runs in polynomial time for correct proofs of membership. □ 

The proof of Lemma [1] shows that 2NFA(2), which contains nonregular languages, has verifiers 
with two random bits. This is the minimum number of useful random bits for 2pfa verifiers. A single 
coin toss would create just two computational paths with equal probability. Since a probabilistic 
machine that always responds correctly can be replaced by its deterministic counterpart, we must 
have the verifier err for at least one input string. But the probability of such an error is at least ^ 
in a machine that tosses its coin only once, which would violate our bounded error condition. 

The reader should also note that the IPSs of Lemma [1] are strictly more powerful than 2pfa's 
unaided by a prover, even when the latter are allowed to use an unbounded number of fair coins, 
since it is known Kan89 IMac98j that the class of languages recognizable by such stand-alone 2pfa's 



is properly contained in the class L. 

The reason why the construction in Lemma [1] does not yield an IPS according to the strong 
definition is that an evil prover can supply an infinitely long fake certificate that makes some paths 
of the verifier enter infinite loops by lyin^ about a head that those paths cannot see, at the cost 
of being rejected by the path responsible for that head. If we forgo the guarantee of halting with 
probability 1 for members of the language, (thereby losing perfect completeness,) and the capability 
of reducing the error bound to any desired nonzero value, settling for an e that is near (but of course 
strictly less than) ^, we can create a strong one-way IPS for any language in NL, as the next lemma 
shows. 

Lemma 2. NL C oneway-IP(cons-space, cons-random-bits). 

Proof. Let L be any language in NL. We first use the construction in the beginning of the proof of 
Lemma [1] to build a verifier V that uses r = [log /c] random bits to simulate one run of the 2nfa(fc) 
associated with L, accepts correct certificates for members of L with probability 1, and rejects any 
incorrect certificate with probability at least 2"''. We then augment V to obtain a new verifier V', 
which uses r + 1 more random bits, as follows: V' rejects directly with probability '^r+l ■ With the 
remaining probability, V transfers control to V. 

V' accepts correct membership certificates with probability "^r+i ; i-^- with an error of ^r+i ■ 
Any incorrect certificate is rejected with probability at least ^^r+l ; yielding a strong IPS with error 
bound "^^Jr+i ■ Note that an honest prover can always supply a certificate that causes V to halt with 
probability 1 for members of L within polynomial time; and V' can be tricked to running forever 
by evil provers only with probability at most "^ir+i • D 

We will now show that two-way interaction with the prover does not augment the power of 
constant-randomness verifiers, even if they are allowed to use logarithmic space, and no requirement 



*Note that the certificate guides the paths of V to position their heads back on the left end-marker and to start 
the next round of coin-flipping simultaneously. 

^We can assume that the simulated multihead automaton has the desirable property mentioned in Fact |3l Any 
prover that causes a long runtime must therefore be lying. 
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of halting with probabihty 1, let alone a time bound, is imposed on computations for inputs in the 
language. 

Lemma 3. I (log-space, cons-random-bits) C NL. 

Proof. We start by showing that any language in I P^; (log-space, cons-random-bits) has an IPS with 
a worst-case polynomial bound on the runtime of the verifier. 

Suppose that a language L has a weak IPS with error e consisting of prover P and logspace 
verifier V, which always uses at most r random bits. Assume without loss of generality that 
V tosses all of its coins at the start, and then transfers control to the appropriate member of 
S={Mi, M2, . . . , M2r}, where each Mi is a deterministic logspace verifier corresponding to the ith 
possible assignment to the r-bit random string. The prover P can be viewed as communicating 
with these deterministic verifiers, and eventually convincing more than half of them to accept the 
input strings in L. Note that the number of distinct reachable configurations of any of the Mj is 
bounded by a polynomial, say, c(n), in the input length n, and these machines can therefore run 
for at most c(n) steps between any two consecutive communication steps. 

Some members of S can have the same communication transcript, that is, they can send precisely 
the same sequence of symbols to P, and therefore receive the same sequence of responses. Since 
this is a private-coin system, P does not know which particular Mi it is talking to in such cases. 
From the point of view of P, the state of V at any communication step is a probabilistic mixture 
(an "ensemble" ) of the configurations of the deterministic verifiers consistent with the interchange 
so far. Since such an ensemble can contain at most 2^ elements, the total number of possible 
ensembles is itself bounded by a polynomial, say, p{n), in n. We therefore conclude that P does 
not need to communicate more than p{n) symbols to convince V for any input string in L, since a 
longer communication would necessarily repeat an ensemble and can be shortened without changing 
the result. It follows that all accepting branches of V have polynomially bounded runtime for all 
members of L when communicating with P. We build a new logspace verifier V' that simulates 
V, rejecting when the execution of any Mj has exceeded this time bound, say, t{n). The new IPS 
consisting of V' and P is clearly seen to handle the language L with error e, r random bits, and 
within time t{n). 

Let us now proceed to show that L € NL, by building a one-way IPS with a deterministic 
logspace verifier M for L. We will use the probabilistic verifier V described above in our con- 
struction. Let us say that V and P use the communication alphabet F, and that V has state set 
Q = CL)N, where C = {q € Q \ 'jq ^ e} is the set of states which communicate with the prover, and 
N is the set of "noncommunicating" states. Recall that V starts by randomly picking a member 
of the set S of 2*" deterministic verifiers, the Mj. 

The purported membership certificate that our new verifier M will check consists of 2^ tracks, 
each with alphabet T = F U {QjOo}. The ith track is supposed to contain a transcript of Mj's 
communications with the prover about the input x. The ith track square of the jth certificate 
symbol contains 

• 7, if Mi receives the prover response 7 in its jth communication step, 

• Oi if performs a halting computation with fewer than j communications, and, 

• 00 otherwise, that is, if Mj enters a nonhalting path of noncommunicating states after per- 
forming fewer than j communications. 

To process the jth. certificate symbol, M simulates all the Mj's that are indicated to be on 
a halting path on the input x until they reach their jth communication step, terminate, or are 
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detected to have entered an infinite loop by running more than c(n) steps. M rejects if it detects 
a mismatch between the track content and the actual computation of M,,. 

Recall that some members of S can have the same communication transcript, and are therefore 
indistinguishable by the prover, for the input at hand. Partition S into blocks, each of which 
correspond to a different communication transcript. M discovers this partition as it goes through 
the certificate. At the start, it considers all the Mj's as in the same block in the initial partition. 
Whenever it scans a new certificate symbol, M refines the partition to separate the Mj's that 
send different symbols, or perform no communication, and rejects if the certificate is claiming that 
different prover messages are being received by two verifiers in the same block of the new partition. 
If any track contains a communication symbol after the appearance of a Q ^ rejects. 

If it detects that the certificate is longer than p{n) steps, M rejects. M accepts if the certificate 
survives these tests, and a majority of the Mj's are verified to terminate with acceptance. 

Clearly, a majority of the members of S accept as a result of their interaction with P on the 
input X if and only if x G L. If the input is not in L, there is no prover that can fool V for more 
than half of its possible coin strings to cause acceptance together, and no certificate can make M 
accept this input. □ 

We have proven that 

Theorem 2. 

oneway-IP(cons-space, cons-random-bits) = NL = I P^u (log-space, cons-random -bits). 

Let REG denote the set of regular languages. We also have the following to say about the 
public-coin versions of these verifiers. 

Fact 4. AM (cons-space, cons-random-bits) — REG. 

This is a special case of the following theorem. 

Theorem 3. For any resource bounds r[n) and s{n), where r[n) is computable in space s{n), and 
r{n) E 0{s{n)), AM^(s-space, r-random-bits) = NSPACE(s). 

Proof. One direction is obvious. For the other direction, we adapt the proof of Lemma [3l Let 
y be a public-coin verifier utilizing r(n) coins and s{n) space for a language L. We build a 
deterministic verifier M. Let the set S consist of the 2''("') deterministic verifiers (the Mj's in the 
terminology of Lemma [3]) obtained by hardwiring all possible coin sequences to V . Since the prover 
is now free to send different messages to each of these verifiers, we do not have to worry about 
checking for consistency among the supplied communication transcripts of those machines. M can 
therefore simulate them sequentially, rather than in parallel, requiring its certificate to just present 
the transcripts of the communication between each Mj and the prover one after another. This 
certificate can be controlled in s{n) space. □ 

4 Restrictions on heads 
4.1 One-way verifiers 

In this section, we will show that a relationship similar to the one established in Section [3] exists 
between verifiers that are further restricted to perform one-way access to their input string, and 
the family of one-way multihead machines, the lnfa(/c)'s. 



8 



Theorem 4. 

oneway-IP (cons-space, cons-random -bits, Iway-input) = 

I P (cons-space, cons-random-bits, Iway-input) = Ufc>ilNFA(fc). 

Proof. One of the nontrivial inckisions is easy to prove: Replace the 2nfa(A:) mentioned in the proof 
of Lemma [2] with any lnfa(A;), and the construction there yields an equivalent one-way IPS with a 
constant-space, constant-randomness verifier that has a one-way input head. 

For the remaining inclusion, suppose that we are given an IPS with a verifier V, which always 
uses at most r random bits, and a one-way input head, for a language L. We start by transforming 
y to a set S of 2^ Idfa verifiers, each of which simulates a version of V with a different assignment 
to the r-bit random string. 

We build a lnfa(2^) M to recognize L. As in the proof of Lemma [3l M guesses a certificate, 
and simulates V to see if this certificate describes a correct transcription of a dialogue of V with 
the prover that ends with the input string being accepted with high probability. M uses a different 
head for representing the head position of each machine in set S. For each newly guessed certificate 
symbol 7, M goes through all the machines in S. Each such machine A can either spend a finite 
number of steps without communicating with the prover, or enter an infinite loop with no further 
communication. The number of distinct configurations of A in this situation equals the number 
of internal states of V, so M can detect if A has entered such a loop easily. In this manner, M 
simulates A until it determines that A is looping, or has halted, or has communicated. M checks 
the certificate for consistency with the information available to the prover, counts the number of 
the elements of S that are observed to accept for legitimate certificates, and halts and accepts if 
this counter reaches 2^~^ + 1. 

If the input is in L, then a prover convinces a majority of the machines in S to accept. M would 
then have an accepting computation path corresponding to that prover. If the input is not in L, 
there is no prover that can fool more than half of V's paths to accept together, and M therefore 
has no accepting path for this input. □ 

The family of one-way multihead automata is known |HKMll] to recognize a proper subclass of 
NL that properly contains the regular languages. For instance, the language of binary palindromes 
is not a member of this class, but its complement is. We can therefore conclude that restricting the 
input head of a verifier to one-way movement does reduce its overall computational power under 
these resource bounds. 

4.2 Real-time verifiers 

The class of languages recognized by real-time nfa(A;)'s is precisely the class of regular languages, 
since having multiple real-time heads on the same tape is no different than having a single head. 
In contrast, we will now show that constant-randomness finite-state verifiers with real-time access 
to their input can verify membership in some non-context-free languages. Consider the language 
TWIN = {uicwlw G {a, 6}*} on the alphabet {a,b,c}. 

Theorem 5. TWIN € oneway-IP(cons-space, cons-random-bits, rt-input). 

Proof. We describe the verifier. Use a random bit to split to two branches on the left end-marker. 
The first branch immediately starts reading the certificate and comparing it with the prefix of the 
input that is followed by the first c, whereas the second branch does not consult the certificate until 
it sees a c in the input. The first branch rejects if the comparison fails, or if it sees that the number 
of c's in the input is not 1. The second branch compares the certificate with the input postfix after 
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the first c, and rejects if that comparison fails. Both branches use two more random bits during 
the executionlf] and reject if both these bits turn out to be zero. They otherwise accept. 

Members of TWIN will be verified to be so with probability | when the certificate is the substring 
appearing on either side of the c. No certificate can convince the verifier with probability greater 
than I when the input is not in TWIN. □ 

Note that oneway- IP (cons-space, cons-random-bits, rt-input) also contains some nonstochastic 
languages, not recognizable by 2pfa's with unbounded error. For example, by using an argument 
similar to the one for TWIN, it is not hard to show that 

NH € oneway-IP(cons-space, cons-random-bits, rt-input), 

where |NH71j NH = {a^'bay^bay^b ■ ■ ■ ay^b \x,t,yi,--- ,yt Z+ and 3k {1 <k <t),x = EiLi^i}- 

In our results above, although the input head was real-time, the certificate head was not, and 
the algorithms used its capability to stay put in some steps critically. Restricting the verifiers to 
having real-time access on both the input and certificate tapes would indeed reduce the class of 
languages with constant-space, constant-randomness to REG, since the construction of Theorem [J] 
can be adapted to obtain an equivalent lnfa(A;) with all heads working real-time for such a verifier. 

5 2pfa's with multiple heads 

We have seen that constant randomness seems to convey the power of possessing multiple heads to 
single-head verifiers. We now turn to machines that already have multiple heads. In this section, we 
examine the effect of limiting the number of allowed coin tosses of 2pfa(fc)'s, that is, probabilistic 
multihead automata. This will turn out to be relevant for understanding the relationship between 
the class L and its randomized generalizations. 

5.1 Two-way heads 

Hartmanis' proof of Facts [T] and [2] |IIar72j is based on a demonstration that multihead finite au- 
tomata and logarithmic-space Turing machines can simulate each other with polynomial slowdown. 
This interchangeability, which extends to the probabilistic versions of these models as well |Mac97j , 
will be useful for our analyses in this section. 

Let us consider the minimum amount of useful randomness for stand-alone 2pfa(A;)'s. Of the 
several modes of recognition associated with probabilistic machines, (i.e. with one-sided or two- 
sided, bounded or unbounded error), we take the least restricted one, namely, two-sided unbounded 
error, where all and only the strings that are members of the language in question are to be accepted 
with any probability greater than ^ . We will use the following variant of Theorem [3l 

Theorem 6. For any resource bounds r{n) and s{n), where r{n) is computable in space s{n), s{n) 
is space constructible, and r(n) e 0(s(n)), the class of languages recognized with PTM's that use 
at most r[n) random bits and s{n) space is contained in SPACE(s). 

Proof. We start with a probabilistic Turing machine M with the properties mentioned in the 
statement of the theorem. We build a deterministic Turing machine D as follows. D computes 
r(n), and starts to simulate all the 2^^"'^ deterministic Turing machines that correspond to different 
coin sequences of M sequentially on the input. Simulations that are detected to enter infinite loops 
(by running more than 2^*^") steps) are cut off. D counts the simulations that are seen to accept, 

®For instance, they may flip coins when scanning the c symbol and the right end-marker. 
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and accepts if and only if this value exceeds 2^("') ^. It is clear that D uses 0{s{n)) space, and 
recognizes the language of M. □ 

Assume that we are given a 2pfa(A;), say, P, that uses at most logarithmically many random bits. 
There exists a logarithmic-space PTM, say, T, that uses precisely the same number of coins, and 
recognizes the same language as P with unbounded error |Mac97j . By Theorem [6l this language 
is in the class L. Note that any language in L is trivially recognized by a 2pfa(A;) that uses no 
randomness by Fact O so we conclude that the class of languages recognized with unbounded error 
by probabilistic multihead finite automata that are restricted to use an amount of random bits that 
is logarithmically bounded in terms of the input length is identical to the class corresponding to 
the deterministic versions of these machines. 

Recall that RL is the class of languages recognized with one-sided bounded error by logspace 
PTM's in polynomial time. Theorem [T] implies that the logarithmic-randomness and polynomial- 
randomness classes for single-head 2pfa's coincide. An analogous result for multiple-head 2pfa's 
would establish that L = RL. 

Let us now turn to multihead finite-state verifiers. By the relationship with logarithmic-space 
Turing machines mentioned above, Equations [2] through [6l as well as our Theorem [21 can also be 
viewed as statements about the power of IPS's whose verifiers are multihead finite automata with 
two-way heads, so we already know that we can use this verifier model to build IPS's with zero 
error for NL, and that constant randomness does not increase their power. Note that the number 
of heads of the verifier will depend on the language under consideration in the constructions for 
these characterizations. 

If we allow arbitrarily small nonzero error and polynomial randomness, but require that at 
most a constant number of coin tosses can be private, we can build an IPS where the finite-state 
verifier is a 2pfa(2) with a halting probability of 1 for every language in NL: The first head runs the 
algorithm of Lemma [H and the second head performs a random walk whose expected completion 
time is a suitably large polynomial (see, for instance, |DS92j ). If this walk completes before the 
first head announces its decision, the verifier rejects. 

5.2 One-way heads 

A "stand-alone" finite automaton with k one-way heads using r coins can be simulated with a 
ldfa(A;2'') that simulates all the 2^ ldfa(A;)'s corresponding to different coin sequences in parallel, and 
accepts if a majority of these ldfa(fc)'s accept. We also know the following about these machines: 

Fact 5. For every k > 1, the class of languages recognized with bounded error by lpfa(k)'s using 
a constant number of coins strictly contains the class of languages recognized by ldfa(k)'s. lFre79 , 
\Kut91^ 

Fact 6. For a fixed k > I, there exists a language recognized by a lpfa(2) using a constant number 
of coins, but not by any Infa(k). \Fre79^ 

Theorem 7. Deterministic finite automata with multiple one-way heads can verify membership in 
precisely the languages in Ufc>ilNFA(A;) with zero error in linear time. 

Proof. Every language in Ufc>ilNFA(A;) can be assumed to have a nondeterministic one-way multi- 
head finite automaton which recognizes it, and is guaranteed to halt in linear time. ldfa(/c) verifiers 
can handle precisely the same languages as Infa(fc) recognizers by definition. □ 

By a simple extension of the proof of Theorem HI we have 
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Theorem 8. Finite automata with multiple one-way heads that use at most a constant amount of 
random bits independent of their input can verify membership ( according to both the strong and the 
weak definitions, and with either one-way or two-way communication with the prover) in precisely 
the languages in Ufc>ilNFA(A;). 

When nonzero bounded error is tolerated, the construction of Theorem |4] can be modified to 
obtain constant-coin lpfa(2) verifiers that hah with probability 1 for each language in U/j>ilNFA(fc), 
by simply using the second head as a clock. 

6 Private alternation with fixed number of universal moves 

Reif |Rei79j defined the private alternating Turing machine (PATM) to model two-person games of 
incomplete information, where one of the players is allowed to hide some of its moves from the other 
player, as opposed to games of complete information, that are well-known to be modeled by the 
alternating Turing machines (ATM's) of [CKSSlj . with which we assume the reader to be familiar. 
A portion of the memory of a PATM is private to the universal states, and cannot be read when 
the machine is in an existential state. The extreme special case where the existential player cannot 
see any moves of the universal player is modeled by the blind alternating Turing machine (BATM), 
which allows the universal states to change only that private portion. Language recognition by 
PATM's is defined similarly to that by ATM's: A string is accepted if and only if there exists a 
winning strategy for the existential player in the corresponding game. 

These models are linked to our results by the observation that a language has an IPS with 
perfect completeness and just a guarantee that nonmembers will be accepted with probability less 
than 1 if and only if it is recognized by a PATM with the same space and time bounds as the 
verifier of that IPS: One simply views the coin-tosses of the verifier as universal moves, and the 
branchings due to the prover messages as possible existential moves of the PATM. Our Theorem [2] 
can then be translated to 

Theorem 9. For any space bound s{n) = O(logn), the class of languages recognized by s{n)-space 
PATM's (or BATM's) that are allowed to make a constant number of universal moves equals NL. 

For contrast, we recall the corresponding classes when the bound on the number of universal 
moves is removed below. (BASPACE(s(n)) (resp. PASPACE(s(n))) denotes the class of languages 
recognized by s(n)-space BATM's (resp. PATM's).) 

Fact 7. BASPACE(l) = NSPACE(n). \PR7^ 

Fact 8. PASPACE(l) = E. \PR79l 

Fact 9. BASPACE(log) = PSPACE. ^^7§ 

Fact 10. PASPACE(log) = EXPTIME. \R^i7^ 

7 Open questions 

We have been able to represent the relationship between NL and NP in the form 

NL = IP (cons-space, cons-random-bits) C I P(log-space, log-random-bits) = NP. 
Further examination of other classes like IP (cons-space, log-random-bits) would be interesting. 
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Do our results for constant-space verifiers stand when a polynomial bound is imposed on the 
overall runtime? Every language that can be verified by a constant-randomness 2pfa that halts 
with probability 1 is recognized in linear time by a 2nfa(A;) for some k. Does there exist a language 
in NL which cannot be recognized in linear time by any 2nfa(A;)? 

Tables [1] and [2] summarize some of our findings on bounded-randomness 2pia,{k) variants, both 
as recognizers, and as verifiers in one-way IPS's. BPTISP(poly, log) denotes the class of languages 
recognized with bounded error by PTM's operating in polynomial time and logarithmic space. The 
cells marked ?i and ?2 correspond to classes that contain the classes corresponding to the cells to 
their left, and are contained in the classes corresponding to the cells above them. Can one find 
better characterizations for these classes? 

Table 1: Complexity classes associated with different settings of 2pfa variants as bounded-error 
recognizers. 



randomness complexity: 





cons 


log 


poly 


single-head two-way 


REG 


REG 


REG 


REG 


single-head one-way 


REG 


REG 


REG 


REG 


multihead two-way 


L 


L 


L 


BPTISP(poly,log) 


multihead one-way 


Uk>ilDFA{k) 


Uk>ilDFA{k) 


?i 


?2 



Although we have proved that 

I P^ (cons-space, cons-random-bits) = IP (cons-space, cons-random-bits), 

we are able to reduce the error probabilities to arbitrary desired positive values only for verification 
according to the weak definition. Is this also possible for the strong definition? Similarly, is there 
a way to reduce the error (which gets worse as the number of heads in the simulated automaton 
increases) of single-head verifiers with one-way access to their inputs to arbitrary desired positive 
values? 

In their study |NY09j of interactive proof systems whose verifiers are quantum finite automata 
(qfa's), Nishimura and Yamakami used a weak model of real-time qfa's |KW97j whose stand- 
alone versions cannot even recognize all regular languages. They showed that letting such verifiers 
communicate with a prover results in a proof system which can handle all and only the regular 
languages. Since general qfa models [HirlOl lYSllj that make full use of the nonclassical features of 
quantum mechanics are able to simulate any corresponding classical system easily, we conclude that 
one-way interactive proof systems that would use qfa's defined according to this modern approach 
would be able to handle all of oneway- IP (cons-space, cons-random-bits, rt-input), outperforming the 
systems of |NY09j , despite the fact that the latter allow for two-way interaction between the verifier 
and the prover. The study of qfa verifiers is an interesting avenue for further research. 

Table 2: Complexity classes associated with different settings of 2pfa variants as bounded-error 
verifiers. 



randomness complexity: 





cons 


single-head two-way 


REG 


NL 


single-head one-way 


REG 


Ufc>ilNFA(fc) 


multihead two-way 


NL 


NL 


multihead one-way 


Ufc>ilNFA(A;) 


Ufc>ilNFA(A;) 
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A The proof of Theorem [1] 

Our proof of Theorem [T] is based on the following |DS90[ IKF91| 

Fact 11. For any polynomial p, 2pfa's with expected runtime 0{p{n)) recognize only the regular 
languages with bounded error. 
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We start by noting that no such program which respects a worst-case bound b{n) on the number 
of random bits that it uses can possibly have a computational path in which a configuration of the 
form (r, i), where r is a coin-tossing state, and i is a head position, repeats. Therefore, 0(n) is a 
tight bound on the number of usable random bits under a worst-case regime. It is also clear that 
contiguous subsequences of configurations with deterministic states can have at most linear length 
in halting computational paths. Therefore, all halting paths of such a machine have worst-case 
runtime O(n^). Furthermore, any nonhalting path must enter an infinite loop of deterministic 
configurations in 0{v?) steps. 

When h{n) is a bound on the expected number of coin tosses, it has a similar relationship 
with the runtime. Any halting path that tosses k coins has length 0{kn). Any nonhalting path 
with nonzero probability must toss only a finite number (k) of coins, so it must enter an infinite 
deterministic loop within 0{kn) steps. So the expected runtime of the halting paths is 0{nb{n)). 

We could use Fact [TT] directly to prove Theorem [T] if we had a guarantee that the machines 
we consider have polynomial expected time. There is no such comfort, however, since it is easy to 
demonstrate cases where a sizable ratio of computational paths do not halt, and expected time is 
therefore not bounded. 

For this reason, we look at the proof of Fact 1111 in detail. One starts by defining a quantitative 
measure of the nonregularity of a language L C S*. For a positive integer n, two strings w, w' G S* 
are n-dissimilar, written w o^L.n w' , if < n, \w'\ < n, and there exists a distinguishing string 
V & Ti* with \wv\ < n, \w'v\ < n, and wv G L iff w'v ^ L. Let NL{n) be the maximum k such that 
there exist k distinct strings that are pairwise -^^L^n- It can be shown |KF90| that 

Fact 12. If L is not regular, then NL[n) > ^ -|- 1 for infinitely many n. 

In the rest of the proof, Dwork and Stockmeyer |DS90j develop a technique for constructing a 
Markov chain PA,xy with 2c states that models the computation of a given 2pfa A with c states 
on the concatenated string xy, where x and y are given strings. State 1 of the Markov chain 
corresponds to M being at the beginning of its computation on the last symbol of (tx. (Note that 
every 2pfa can be modified to start here, without changing the recognized language. The nonhalting 
states of the modified 2pfa are {^i, (?2) ■ ■ ■ ■, 9c-i}-) For 1 < j < c — 1, state j of the Markov chain 
corresponds to M being in the configuration with the machine in state qj and the head on the last 
symbol of (tx, and state c + j — 1 corresponds to M being in the configuration with the machine 
in state qj and the head on the first symbol of yd;. State 2c — 1 corresponds to a disjunction of 
rejection, infinite loop with the head never leaving the region (fx, and infinite loop within the region 
yet. State 2c corresponds to acceptance. The probability that PA,xy is absorbed in state 2c when 
started in state 1 equals the probability that A accepts xy. 

The proof then considers any 2pfa M that recognizes language L in expected time T{n), and 
proceeds to establish a lower bound, in terms of NL{n), on T[n). This is accomplished by showing 
that, for sufficiently large values of n, if the desired lower bound does not exist, then there must 
be two pairwise ^L,n strings w and w' , with distinguishing string f, such that the Markov chains 
Pm,wv and Pm,w'v are "too close" according to a notion of closeness defined in |DS90| . In a step 
crucial for our purposes, ( |DS90| . page 1015, Lemma 4.2,) it is proven that, if Pm,wv and Pm,w'v are 
so close, and if it is guaranteed that both Markov chains are absorbed to state 2c — 1 or 2c with total 
probability 1 within expected time T(n), then the acceptance probabilities of wv and w'v must be 
so close that they must both be members (or non-members) of L, contradicting their n-dissimilarity, 
thereby establishing the desired bound on T{n). Fact 1111 is then obtained by combining this result 
with Fact [l2l 

In the case of our machines, the Markov chains produced according to the construction men- 
tioned above do turn out to be that close to each other, but they do not necessarily satisfy the 
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guarantee of absorption to state 2c — 1 or 2c, since M can possibly enter an infinite loop in which 
the head shuttles back and forth over the (ttt; (resp., (tw') and uct regions. Fortunately, this problem 
goes away on a careful look: Consider all cycles of transitions that have probability 1 between 
the two regions in the produced Markov chains. The set of states appearing in such a cycle is an 
absorbing class. Furthermore, it is certain that absorption to either state 2c — 1, or 2c, or one of 
these loop classes will take place within expected time nb{n), and the acceptance probability would 
not change if one redirected these transitions to state 2c — 1, so Lemma 4.2 of jDS90j still applies, 
and we can conclude with the same reasoning as in the proof of Fact I 111 that if b{n) is polynomially 
bounded, then L is regular. 
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